Registry:

IoOpenDeviceRegistryKey
IoOpenDeviceInterfaceRegistryKey

ZwOpenKey
ZwClose
ZwQueryValueKey
ZwSetValueKey
RtlDeleteRegistryValue
…

File:

Must running at PASSIVE_LEVEL

ZwCreateFile
ZwClose
ZwReadFile
ZwWriteFile

This entry was posted on Tuesday, July 25th, 2006 at 6:02 pm and is filed under Windows Kernel. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.